Hi,
Now bpf_jit_harden will be tested twice for each subprog if there are
subprogs in bpf program and constant blinding may increase the length of
program, so when running "./test_progs -t subprogs" and toggling
bpf_jit_harden between 0 and 2, extra pass in bpf_int_jit_compile() may
fail because constant blinding increases the length of subprog and
the length is mismatched with the first pass.
The failure uncovers several issues in error handling of jit_subprogs()
and bpf_int_jit_compile():
(1) jit_subprogs() continues even when extra pass for one subprogs fails
It may leads to oops during to UAF. Fixed in patch #1.
(2) jit_subprogs() doesn't do proper cleanup for other subprogs which
have not went through the extra pass.
It will lead to oops and memory leak. Fixed in patch #2. Other arch JIT
may have the same problem, and will fix later if the proposed fix for
x86-64 is accepted.
(3) bpf_int_jit_compile() may fail due to inconsistent twice read values
from bpf_jit_harden
Fixed in patch #3 by caching the value of bpf_jit_blinding_enabled().
Patch #4 just adds a test to ensure these problem are fixed.
Comments and suggestions are welcome.
Regards,
Tao
Hou Tao (4):
bpf, x86: Fall back to interpreter mode when extra pass fails
bpf: Introduce bpf_int_jit_abort()
bpf: Fix net.core.bpf_jit_harden race
selftests/bpf: Test subprog jit when toggle bpf_jit_harden repeatedly
arch/x86/net/bpf_jit_comp.c | 35 ++++++++-
include/linux/filter.h | 2 +
kernel/bpf/core.c | 12 ++-
kernel/bpf/verifier.c | 8 +-
.../selftests/bpf/prog_tests/subprogs.c | 77 ++++++++++++++++---
5 files changed, 120 insertions(+), 14 deletions(-)
--
2.29.2
